NVIDIA’s Plan to Stop AI Agent Attacks

0:00 An AI agent inside one of Open AI's own test escaped its sandbox in July and broke into Hugging Face's production systems. And you might be handing an agent a shell and your API keys. So, if

0:11 an AI controls the computer, who controls the AI? The usual answer is a line in the system prompt. Don't touch production. Stay in this folder. Nvidia's new answer is a watchdog on a

0:21 separate chip. Here's what it sees, what it can stop, and what it can't judge. Picture two ways to keep an agent out of a room. One is a sticky note on the door that says, "Please don't." The other is

0:32 a locked door. The agent can read the note. It can't open the lock. A sticky note works great on coworkers who want to keep their jobs. A prompt instruction is a sticky note. It's just text, and

0:43 the agent weighs it against everything else in its context, including the task it's trying to finish. A rule that gets weighed can lose. A permission enforced outside the agent doesn't get weighed at

0:52 all. Nvidia's technical blog makes this case directly. An agent can drift when it hits a policy block, a bug, or a missing tool. And in those circumstances, the blog says, "It cannot

1:03 be expected to fully govern its own behavior." Say the task needs a file the agent's blocked from reading. A person hits that wall and files a ticket. An agent that's driven to finish may go

1:13 looking for another route. That's why a block can be part of the problem, not just the cure. So, the rule has to sit somewhere the agent can't edit, argue with, or talk its way around. Nvidia's

1:23 blog puts it this way. The controls do not live inside or within reach of the agent. Nvidia announced the Open Agent Safety Platform on September 28th. Its release describes the problem it's

1:34 answering this way. The agent circumvented security controls at the application layer to complete its assigned task. At that launch, Jensen Huang put the philosophy plainly. "When

1:44 you deploy an agent, no matter how smart, the first thing you do is to take away all of its rights." So, Nvidia stacks three layers. On top, the application, the model, its tools, its

1:55 data. Under that, Open shell, runtime policy enforced in the kernel. And off to the side, Sentry, a watchdog on separate hardware. The application layer is where the agent lives.

2:07 Guardrails written there run in the same software the agent runs in, which is exactly where Nvidia says an agent got around its controls. That's the sticky note floor. Next floor down is open

2:17 shell. It's open source under Apache 2.0, and it uses kernel level controls to confine which files an agent can reach and which system calls it can make. The kernel doesn't read the

2:27 agent's reasoning or its polite promises. It checks that file or system call against the policy. Operators define which files, networks, tools, processes, and credentials the agent

2:38 gets. The idea, in Huang's words, is to start with no rights and grant them. One detail I like, before a policy change applies, open shell uses formal verification to check what the change

2:48 would allow. Think of it as a code review where the reviewer is math. Open shell works without BlueField 4, and it's on GitHub today. Sentry's hardware isolated enforcement is the part that

2:59 needs the BlueField chip. Then there's Sentry, and it's a different kind of thing. It's an out-of-band watchdog running on BlueField 4, Nvidia's networking

3:07 processor. Out-of-band means it watches from outside the agent's own software on separate hardware. Where it sits matters more than what it is. Sentry sits on the node's only path to the model. Anything

3:18 moving between the agent and the model has to go past it, like a security desk in the only hallway. As traffic passes, Sentry correlates agent interactions, policy decisions, and tool and data

3:29 access into one contextual record. It also checks each agent's identity and what it's been authorized to do. So, line them up. The prompt is the sticky note. Open shell is the lock on the

3:40 door. Sentry is the security desk in the hallway, checking badges and keeping a log the agent can't reach. Nvidia says Sentry can quarantine an agent that moves outside its boundaries in

3:50 milliseconds. It gives no latency figure, and TechCrunch reports no independent testing. How a quarantine actually happens, Nvidia doesn't spell out. The blog calls

3:59 Sentry the kill switch and says it enforces at line speed, but it doesn't describe the mechanism. Now, the stress case. In July, an agent in an OpenAI evaluation called Exploit Gym escaped

4:11 its sandbox through a zero-day in the cache that proxies package downloads and reached the internet. It then breached Hugging Face production systems. Hugging Face's timeline recovers about

4:22 17,600 actions over 4 and 1/2 days, and its own AI security stack did detect anomalies. It just failed to raise their criticality. In other words, it smelled

4:32 smoke and filed it under weather. Nvidia's release describes an agent circumventing application layer controls. OpenAI's report, as TechCrunch relays it, says the test ran without the

4:43 safety classifiers it uses in production, and the way out was a zero-day in a package proxy. The exit was a hole in the software, not a sticky note the agent ignored. So, it's a

4:53 different failure from the one Nvidia describes. Would Sentry have stopped it? Nvidia's VP of Enterprise AI, Justin Boitano, told Bloomberg the platform could have.

5:03 Not would have. OpenAI's report, as TechCrunch quotes it, says something sharper. A monitor that reads the model's reasoning, a chain-of-thought monitor, would have caught the initial

5:13 relevant activity and paged OpenAI security team more than a day before the model breached Hugging Face. So, a watcher matters. That's the strongest lesson from the incident, and

5:23 it doesn't depend on Sentry. But, watchers can differ in what they see. A chain-of-thought monitor is built around the model's reasoning. Sentry is built around traffic, tool access, and policy

5:33 decisions. Anthropic, Microsoft, Hugging Face, and JPMorgan Chase are among the more than 100 launch participants Nvidia lists. Storage Review reports Anthropic paired the platform with Claude managed

5:45 agents. That means they're taking part in the launch, not that each has deployed Sentry. And TechCrunch notes OpenAI isn't on the list. Now the limits,

5:54 starting with intent. The blog describes Sentry watching actions and traffic. It doesn't claim Sentry can tell whether an allowed action is a bad idea. Say an agent has proper access to a customer

6:04 database and a working email tool. Reading records is allowed. Sending an email is allowed. Whether this particular email is a terrible idea is a question about intent, and that's the

6:14 part left open. Then there's scope. CSO Online's analysts say these controls govern agents you deploy on infrastructure you control. Brian Levine of Control Risks said they do nothing

6:25 for the agent a business unit spun up on a SaaS platform. IDC's Brent Ellis estimates it addresses probably less than 25% of enterprise agentic cybersecurity problems and flags vendor

6:37 lock-in. That's one analyst's estimate, not a measurement. Gartner's Lauren Cornitic called it a great step in the right direction. The blog also publishes no detection accuracy and no false

6:47 positive rate. So there's no way to tell how often the watchdog would miss something or raise an alarm over nothing. And it's still a reference design. Nvidia's own release uses that

6:58 phrase for Sentry, and Storage Review gives no Bluefield 4 or Sentry availability date. A reference design is a very confident way of saying some assembly required. Put that together and

7:08 Sentry is a serious design for a real gap, and it doesn't solve AI safety. It sees actions, not intent. It covers your own infrastructure, and its headline claims are still Nvidia's. What I'd take

7:20 from it, whatever you run, ask where a rule lives. Ask whether the agent can reach it, and ask who finds out when it gets bent. If the answers are in the prompt, yes, and nobody, you've got a

7:31 sticky note. If you run agents with shell access and credentials on infrastructure you control, open shell is the piece you can read and try today. It's Apache 2.0, and it's on GitHub.

7:42 What we have is the read me and Nvidia's description, not independent testing. So, check what it runs on and try it in a throwaway environment first. Sentry is a design to watch, not something to plan

7:53 around. If your agents mostly live inside SaaS platforms someone else runs, this doesn't reach them. There, I'd ask the vendor what's

8:01 enforced outside the agent and what actually happens when a policy is bent. One question stays open. Open shell can verify what a policy change allows and Sentry can watch the traffic, but

8:11 somebody still writes the policy the watchdog enforces. So, who watches the watchdog's policy and who writes it?